CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter

The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.7.2 - Contributor+ Unpublished Event Disclosure vulnerability

Contributor+ Unpublished Event Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.3.6-5.7.2...

CVE-2026-91077 Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

EUVD-2026-85042

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

EUVD-2026-85043

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

EUVD-2026-85038

The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published...

CVE-2026-93952

creationtimestamp| type| source ---|---|--- 2026-09-22 07:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw3qipnnvk2t 2026-09-22 09:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117313871866403815 2026-09-22 09:00:28+00:00| seen|...

CVE-2022-1388

我忘记发布的旧漏洞利用。...

CVE-2026-93455 django-page-cms through 2.0.13 Unauthorized Content Access via Staff Account

django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page...

WP < 7.1.1 - Contributor+ Unpublished Post Title Disclosure

Description WordPress does not check that the user is allowed to access a post before returning its sample permalink in some cases, which could allow users with a role as low as contributor to retrieve the titles of other users' draft and pending posts...

WordPress LearnPress plugin 4.2.7.1-4.4.6 - Unauthenticated Unpublished Course Disclosure vulnerability

Unauthenticated Unpublished Course Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin LearnPress versions 4.2.7.1-4.4.6...

CVE-2026-86449

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed one...

CVE-2026-89026

creationtimestamp| type| source ---|---|--- 2026-09-15 18:08:59+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvl7sxnjy62j 2026-09-15 18:20:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvlagwcy572w 2026-09-16 13:16:18+00:00| seen|...

CVE-2026-91998

creationtimestamp| type| source ---|---|--- 2026-09-15 13:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6qzzxavbnrej6 2026-09-15 14:08:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvksenru5t2f 2026-09-15 17:30:04+00:00| seen|...

WordPress WP Directory Kit plugin <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure vulnerability

Unauthenticated Unpublished Listing Disclosure vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Directory Kit versions = 1.5.7...

CVE-2026-18232

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-86283

creationtimestamp| type| source ---|---|--- 2026-09-14 01:00:04+00:00| seen| https://t.me/GithubRedTeam/102243 2026-09-14 03:00:06+00:00| seen| Telegram/HpvRlDBORm0kLsO1zg2R5Kugqpwi6YOLawI6LgE5lPyRWI 2026-09-15 00:00:30+00:00| published-proof-of-concept|...

CVE-2026-73315

creationtimestamp| type| source ---|---|--- 2026-09-08 15:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muzbzzw62s22 2026-09-08 15:12:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2utzt2ez7wxpe...

CVE-2026-86165

creationtimestamp| type| source ---|---|--- 2026-09-05 18:19:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117219809348083174 2026-09-06 04:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mut46qvwjy2j 2026-09-06 05:52:24+00:00| seen|...